skills/ace-step/ace-step-1.5/acestep/Gen Agent Trust Hub

acestep

Pass

Audited by Gen Agent Trust Hub on Mar 9, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes a bash script to perform API requests and file operations. Commands are strictly scoped to health checks, configuration management, and the execution of music generation tasks via curl and jq.- [EXTERNAL_DOWNLOADS]: The skill communicates with the ACE-Step official API at api.acemusic.ai (or a local address) to generate music. Audio files are downloaded from this vendor-controlled domain and saved to a dedicated output directory in the project root. This is the primary intended function of the skill.- [CREDENTIALS_UNSAFE]: The skill manages an API key stored in a local config.json file. The script includes a dedicated masking feature to prevent the key from being displayed in plain text during configuration listing. Additionally, the skill instructions provide specific guidance to the agent to avoid reading or exposing the key unnecessarily.- [DATA_EXFILTRATION]: No unauthorized data transmission was detected. All network traffic is directed to the user-configured API endpoint for the purpose of music synthesis and metadata retrieval.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 9, 2026, 12:38 PM